<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted0">
Hello,
<div><br class="ContentPasted0">
</div>
<div class="ContentPasted0">I hope everyone is doing well!</div>
<div><br class="ContentPasted0">
</div>
<div class="ContentPasted0">Below is the entry for today.</div>
<div><br class="ContentPasted0">
</div>
<div class="ContentPasted0">09/29/2022 - Diary entry #605:</div>
<div><br class="ContentPasted0">
</div>
<blockquote style="margin-top:0;margin-bottom:0">
<div class="ContentPasted0 ContentPasted1">Prilex is a Brazilian malware that started its activities targeting ATMs in 2014 – when a Brazilian bank had 10,000 of its ATMs hacked. In 2016, the threat actors behind Prilex changed their focus to Point Of Sales
(PoS) devices. After that, in 2019 they claimed responsibility for an attack against a German bank, resulting in €1.5 million in losses, followed by a peak of activity in 2020, and finally going dark in 2021. Now, they resumed their activities with a release
of three new variants, suggesting that they were focusing on developing a more sophisticated version of Prilex.
<div><br class="ContentPasted1">
</div>
<div class="ContentPasted1">As the security and anti-fraud mechanisms evolved, the threat actors changed their attack chain. The infection process starts with a spear-phishing email posing as a PoS vendor technician luring the companies (shops, gas stations,
and restaurants) to update their PoS software. Then, a fake technician replaces the PoS firmware with a malicious version either on-premise or remotely via AnyDesk.</div>
<div><br class="ContentPasted1">
</div>
<div class="ContentPasted1">The operators can then control the PoS terminals using a custom backdoor, a stealer for intercepting all data, and an exfiltration module. All these tools are used for modifying transaction contents, capturing credit card information,
and requesting new cryptograms from the cards.</div>
<div><br class="ContentPasted1">
</div>
<div class="ContentPasted1">All intercepted data from the transactions are saved locally to an encrypted file and sent periodically to the malware C2 server. Then, the criminals are able to make transactions via fraudulent PoS devices registered in the name
of fake companies.</div>
<div><br class="ContentPasted1">
</div>
The sophistication of the attack and toolkit shows that the threat actors behind Prilex are highly skilled and capable of escalating their attacks by offering their tools as a Malware-as-a-Service. Therefore, we recommend companies that use PoS terminals secure
their environment both physically and digitally, training their employees against social engineering attacks.<br>
</div>
</blockquote>
<div><br class="ContentPasted0">
</div>
Kind Regards,<br>
</div>
<div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<table style="font-size:medium; font-family:"Times New Roman"">
<tbody>
<tr>
<td style="width:180px" align="left">
<table width="120" align="left">
<tbody>
<tr>
<td colspan="3" align="center"><a href="https://www.appgate.com/" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="margin:0px" width="120" height="30" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/logo@2x.png"></a></td>
</tr>
<tr>
<td colspan="3" align="center"> </td>
</tr>
<tr>
<td width="37%" align="center"><a href="https://www.linkedin.com/company/appgate-security/" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="margin:0px" width="18" height="18" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/likedin@2x.png"></a></td>
<td width="28%"><a href="https://twitter.com/AppgateSecurity" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="margin:0px" width="20" height="18" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/twitter@2x.png"></a></td>
<td width="35%"><a href="https://www.youtube.com/channel/UC-8GvxcZbm-R3EJNl8jYjiQ" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="width: 26px; height: 18px; max-width: initial;" width="26" height="18" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/youtube@2x.png"></a></td>
</tr>
</tbody>
</table>
<p style="margin-top:0px; margin-bottom:0px"> </p>
</td>
<td colspan="2" rowspan="2" style="width:350px">
<p style="color:rgb(12,12,12); font-size:13px; font-family:Arial,Helvetica,sans-serif; margin-top:0px; margin-bottom:0px">
<strong>MART</strong><br>
</p>
<p style="color:rgb(12,12,12); font-size:13px; font-family:Arial,Helvetica,sans-serif; margin-top:0px; margin-bottom:0px">
Malware Analysis and Research Team<br>
<strong>Appgate</strong></p>
<p style="color:rgb(12,12,12); font-size:13px; font-family:Arial,Helvetica,sans-serif; margin-top:0px; margin-bottom:0px">
E:<span style="margin:0px"> <a href="mailto:ctas-mat@appgate.com" title="mailto:ctas-mat@appgate.com">
ctas-mat@appgate.com</a></span><br>
</p>
<p style="color:rgb(12,12,12); font-size:13px; font-family:Arial,Helvetica,sans-serif; margin-top:0px; margin-bottom:0px">
<span style="margin:0px; background-color:white"><br>
</span></p>
</td>
</tr>
</tbody>
</table>
<br>
</div>
</div>
</div>
</div>
</body>
</html>